diff --git a/registry/auth/token/accesscontroller_test.go b/registry/auth/token/accesscontroller_test.go
index ba3d0a37a..c762a7e58 100644
--- a/registry/auth/token/accesscontroller_test.go
+++ b/registry/auth/token/accesscontroller_test.go
@@ -143,8 +143,8 @@ func TestRootCertIncludedInTrustedKeys(t *testing.T) {
 	// newAccessController return type is an interface built from
 	// accessController struct. The type check can be safely ignored.
 	ac2, _ := ac.(*accessController)
-	if got := len(ac2.trustedKeys); got != 1 {
-		t.Fatalf("Unexpected number of trusted keys, expected 1 got: %d", got)
+	if got := len(ac2.trustedKeys); got != 2 {
+		t.Fatalf("Unexpected number of trusted keys, expected 2 got: %d", got)
 	}
 }